The Department of Homeland Security has ordered federal civilian agencies to stop acquiring DeepSeek products and services and to remove them from federal IT systems. The notice was posted to the Federal Register's public inspection site on October 19, 2026, with formal publication scheduled for October 20, according to PYMNTS. The most consequential sentence in the order is about third parties: agencies must also remove products built on DeepSeek implementations, a clause that reaches well beyond the DeepSeek app.
DeepSeekWhat the order does
Based on PYMNTS and a detailed summary of the notice, the order has five parts:
- Procurement exclusion: agencies stop buying DeepSeek products, including through approved product lists and e-commerce marketplaces. This takes effect immediately.
- Removal: agencies must remove DeepSeek products, and third-party products built on DeepSeek implementations, from their IT systems.
- Interim safeguards: until removal is complete, agencies are to monitor network traffic, increase logging, add controls against data leaving their systems and flag unusual activity.
- Exceptions: requests must be made in writing within 60 days of the order's issue date, with a compelling justification and alternative safeguards. CISA reviews them and responds in writing.
- Review: the Secretary must review the order within a year and annually after that.
The order is reported as Order 2026-01, signed by DHS Secretary Markwayne Mullin and dated July 24, 2026, then kept out of public view until this week. Reports disagree on the signing date, with one outlet giving June 26, so treat the date as unsettled until the Federal Register text is read directly. The Federal Register document number is 2026-21447.
The order covers the civilian executive branch. It excludes national security systems and sensitive compartmented information systems, which fall under the Pentagon and the Director of National Intelligence.
The legal route matters as much as the ban
According to Technology.org and PYMNTS, DHS relied on a 2018 supply chain security law, which is generally cited as the Federal Acquisition Supply Chain Security Act. That statute lets DHS order the exclusion or removal of products from federal procurement and IT, following a recommendation from the Federal Acquisition Security Council. Reports differ on how much of the Council's role the notice spells out.
The route is different from earlier US actions. Per Technology.org, the Commerce Department banned DeepSeek on government-furnished equipment in March 2025, and Texas, Australia, Taiwan and Italy had also acted. Those measures mostly governed devices or a single jurisdiction. A procurement-and-removal order operates through contracts and supply chains, so it can reach resellers, integrators and software that embeds a model.
Illustrative scope ladder. Bar length is a qualitative ordering of how many layers each action reaches, not a measured quantity.
The stated risks, and what the order does not claim
DHS describes DeepSeek as a privately owned company in China and says its models "present multiple threat vectors," per PYMNTS. The listed concerns:
- Chinese laws that let authorities access private company infrastructure.
- An account-creation process that collects personal information, and which may track and fingerprint users.
- A prompt-and-response process that asks users to share information with the model.
- A warning that sending information to China could yield "actionable intelligence on U.S. persons and/or government programs," and that "The models themselves may contain malware or other security vulnerabilities."
The order cites public sources, according to the detailed summary: DeepSeek's privacy policy, a 2020 DHS business advisory on Chinese data risks, an April 2025 House Select Committee on China report, and a February 2025 NowSecure audit that found critical flaws in the DeepSeek iPhone app. That summary notes the order does not describe any case of government data reaching DeepSeek. The justification is therefore structural (jurisdiction, data collection, possible vulnerabilities) rather than an incident.
The order's reach turns on three words: built on DeepSeek.
Analysis
The open question: hosted and open-weight models
The reports agree the third-party clause is the broadest part, and that the order does not list specific products or say how agencies should treat DeepSeek models running on US company servers. That gap is where compliance work will concentrate, because DeepSeek has released open-weight models, including recent versions covered in our DeepSeek V4.1-Flash update analysis, that other providers can host.
| Scenario | Likely status | Why it is unclear |
|---|---|---|
| DeepSeek's own app or API | Covered | Named directly |
| A vendor product that calls DeepSeek's API | Likely covered | Third-party clause |
| A US-hosted copy of an open-weight DeepSeek model | Unsettled | Order does not address hosting location |
| A model fine-tuned or distilled from DeepSeek weights | Unsettled | "Implementation" is not defined in the reports reviewed |
| A product using an unrelated model | Not covered | No DeepSeek component |
The table is our reading of the reported text, not legal advice. Agencies and contractors will likely ask CISA or counsel, and the 60-day exception window (counted from the order's issue date, which reports place in July) may matter for anyone planning a request.
What to watch
- The Federal Register text: whether it defines "implementation" and how it treats hosted open weights.
- CISA guidance: exception decisions will show how strictly the third-party clause is read.
- Contractor flow-down: federal suppliers may be asked to certify that no DeepSeek component sits in what they deliver.
- Reciprocal actions: whether other governments or large enterprises copy the supply-chain framing rather than the device-ban framing.
For organizations outside government, the practical lesson is architectural. When a model becomes restricted in one jurisdiction or contract, teams that route work through a swappable model layer can change providers with a configuration change. Platforms that expose many providers behind one interface, Metir among them, make that kind of substitution a routine setting rather than a migration.
Sources:
- DHS Bans DeepSeek Across Federal Government Networks (PYMNTS)
- The US is ordering every civilian agency to rip out DeepSeek, even tools built on it (Mad Robot, Oct 19, 2026)
- DHS Orders DeepSeek Off US Federal Systems (Technology.org, Oct 20, 2026)
Image credits
Header and in-body image: Department of Homeland Security new headquarters ceremony, April 10, 2019, U.S. Department of Homeland Security photo, public domain, via Wikimedia Commons. Illustrative.